Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits
Proofpoint reports the BlueMoon exploit kit, chaining two Chrome V8 zero-days and a Windows ALPC bug, being shared across China-linked espionage groups.
85
Organization
China Ministry of State Security
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenSep 9, 2026
- Last mentionedSep 9, 2026
Timeline
3 articles · newest firstChinese espionage groups swarm to exploit triple-link chain of zero-days
At least four China-aligned espionage groups chained three zero-days in Chromium browsers and Windows ALPC for espionage since late August.
88
Chinese espionage groups swarm to exploit triple-link chain of zero-days
Four China-aligned espionage groups, starting with TA412/APT31, chained zero-days CVE-2026-85046, CVE-2026-87491 and CVE-2026-85880 to spy on targets since late August.
85
Related CVEs
by mentions- CVE-2026-850462%8.8Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
- CVE-2026-85880<1%7.8Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
- CVE-2026-874914%8.8Actively Exploited Out-of-Bounds Write in Google Chrome V8
Appears with
- TA412threat actor · 3
- APT31threat actor · 3
- Google Geminiproduct · 3
- Violet Typhoonthreat actor · 3
- Google Chromeproduct · 3
- UNK_LateNightthreat actor · 3
- Proofpointvendor · 3
- UNK_QuietRacketthreat actor · 2
- UNK_DoubleCheckthreat actor · 2
- Googlevendor · 2
- Microsoft Windowsproduct · 2
- Microsoftvendor · 2
- Google Geminiai model · 1
- Proofpointorganization · 1
- GemStonemalware · 1
- Microsoft Edgeproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.